Misconceptions About Samba 4

If you update to Samba 4 and later, you do not have to migrate to Active Directory.

The Active Directory (AD) Domain Controller (DC) support is one of the enhancements introduced in Samba 4.0. However all newer versions include the features of previous versions - including the NT4-style (classic) domain support. This means you can update a Samba 3.x NT4-style primary domain controller (PDC) to a recent version, as you previously updated, for example from 3.4.x to 3.5.x. There is no need to migrate an NT4-style domain to an AD.

Additionally, all recent versions continue to support setting up a new NT4-style PDC. The AD support in Samba 4.0 and later is optional and does not replace any of the PDC features. The Samba team understand the difficulty presented by existing LDAP structures. For that reason, there is no plan to remove the classic PDC support. Additionally we continue testing the PDC support in our continuous integration system.

The Update Process

Run the following steps, whether you are updating a Samba Active Directory (AD) domain controller (DC), a Samba NT4-style PDC, a Samba domain member, or a standalone installation:

Stop all Samba services.

Create a backup.

Read the release notes of skipped versions. They contain important information, such as new features, changed parameter, and bug fixes. In case you switch to new major release, read the release notes of the initial version (x.y.0) and the ones from minor versions up to the new version you will update to. For example, if you update from 4.4.4 to 4.6.2, read the 4.5.0, 4.6.0, 4.6.1, and 4.6.2 release notes.

Install the latest version over your existing one:

If you compile Samba from the sources, use the same configure options as used for your previous version. For more information, see Build Samba From the Sources.

If you update using packages, read the distribution documentation for information how to update.

Updating Multiple Samba Domain Controllers

If you are updating multiple Samba Active Directory (AD) Domain Controllers (DC), the recommended order is:

Update one Samba AD DC that does not hold any flexible single master operations (FSMO) role.

Start Samba on the updated DC.

Verify that the directory replication between all DCs is working correctly:

# samba-tool drs showrepl

Test the installation to ensure that the new version works correctly.

Upgrade all other Samba DCs one at a time and always verify that the replication is working correctly.

Samba AD DC Database Check

The samba-tool utility enables you to detect and fix problems in the Samba Active Directory (AD) database. For example, if a previous Samba version stored an attribute incorrectly and the updated version fixes the problem. You must run the check and fix command on every Samba AD DC locally, because some fixes apply to non-replicated attributes and modifications are not replicated to other DCs.

To check the AD database, run:

# samba-tool dbcheck --cross-ncs

To fix reported errors, run:

# samba-tool dbcheck --cross-ncs --fix

If you pass the --yes parameter to the command, all questions are automatically answered with yes. Note that if you omit the --yes parameter, the database check executes three fsync() calls for each object. This can result in a longer run duration. For example, passing the --yes parameter to the command fixed 3500 objects in 10 seconds in our test environment. Without this parameter, the command required 4:50 minutes for the same operation.

After a repair, re-check the database to verify a successful operation.

Notable Enhancements and Changes

If you are updating Samba, always read the release notes of all versions between the previous and the one you are updating to. They contain important and additional information on new features, changed parameter options, and so on.

This section provides an overview about important changes that require your attention to fix problems of previous versions, avoid a negative performance impact, and so on.

Changes Affecting All Samba Installation Modes

File Execution Permissions

4.0.0 and later

Previously, Samba did not check the execution bit of files. As a consequence, users could execute files, such as *.exe and *.bat, on a share, if the x-bit was not set. Samba has been enhanced and now denies to execute a file if the x-bit is not set. In situations, such as when upgrading from a previous version, your executable files can be missing the x-bit. As a workaround, you can enable the old behaviour, if you set the following parameter for individual shares or in the [global] section:

acl allow execute always = yes

Samba Active Directory Domain Controllers

The ntvfs File Server Back End Has Been Disabled

4.5.0 and later

Previously, Samba enabled users to provision a domain controller (DC) using the ntvfs file server back end. This back end was never supported, and thus the ntvfs feature is no longer build by default in Samba 4.5.0. Consequently, starting the samba service on a DC using the ntvfs back end failed after the update and the following error is logged:

Fixing replPropertyMetaData Attributes

4.5.0 and later

Samba versions prior to 4.5.0 stored the replPropertyMetaData attribute incorrectly. As a consequence, administrators could experience, for example, renaming conflicts. The problem has been fixed in 4.5.0 and later versions and Samba now stores the attribute correctly. The samba-tool utility has been enhanced to detect incorrectly stored replPropertyMetaData attributes:

Failure To Access Shares on Domain Controllers If idmap config Parameters Set in the smb.conf File

4.4.6 or later

The winbindd service on a Samba Active Directory (AD) domain controller (DC) automatically uses the IDs set in the Active Directory uidNumber and gidNumber attributes of user accounts and groups. If the attributes are not set, Samba generates IDs locally on the DC and stores them in the idmap.ldb database. Thus, on a Samba AD DC, idmap config parameters set in the smb.conf file were ignored. Due to a bug in Samba 4.4.6 and later, the parameters are no longer ignored and clients fail to connect to shares on the DC. To fix the problem:

Remove all idmap config parameters in the smb.conf file on DCs.

Restart the samba service.

Restart the clients.

As a result, clients now correctly connect to shares on the DC.

New Default for LDAP Connections Requires Strong Authentication

4.4.1 or later / 4.3.7 or later / 4.2.10 or later

The security updates 4.4.1, 4.3.7 and 4.2.10 introduced a new smb.conf option for the Active Directory (AD) LDAP server to enforce strong authentication. The default for this new option ldap server require strong auth is yes and allows only simple binds over TLS encrypted connections. In consequence, external applications that connect to AD using LDAP, cannot establish a connection if they do not use or support TLS encrypted connections.

Applications connecting to Samba AD using the LDAP protocol without encryption, will display the error message:

AD Database Cleanup of Deleted LDAP DNS Entries

4.1.12 or later

Previously, Samba incorrectly created deleted Active Directory (AD) objects for removed DNS entries. The problem has been fixed. If you start the first Domain Controller (DC) with a fixed Samba version, all deleted objects are removed. As a result, this can result in a slow performance until the deleted objects are removed.

Incorrect TLS File Permissions

4.1.2 or later / 4.0.12 or later

Previously, Samba created the *.pem files used for LDAP TLS encryptions with insecure permissions. To avoid insecure connections, delete the files on all domain controllers (DC):

# rm /usr/local/samba/private/tls/*.pem

Restart Samba after you deleted the files to automatically re-create the new certificates.

Fixing Dynamic DNS Update Problems

Fixing Incorrect Sysvol and Directory ACLs

When updating from early 4.0.x versions, 4.0 beta and 4.0 release candidates.

To reset wrong Sysvol ACLs, run:

# samba-tool ntacl sysvolreset

To reset all well known ACLs in the directory, run:

# samba-tool dbcheck --cross-ncs --reset-well-known-acls --fix

To fix errors in the Active Directory (AD) database, run:

# samba-tool dbcheck --cross-ncs --fix

Samba Domain Members

ID Mapping Configuration Verification

4.6.0 or later

Previously, Samba did not verified the ID mapping configuration in the smb.conf file on a domain member. Thus, users could set an incorrect ID mapping configuration, such as overlapping ID ranges or incorrect back ends for the default domain. Consequently, the winbindd service started and ID mapping failed or did not work as expected. The testparm utility has been enhanced and now reports incorrect ID mapping configurations. For example:

ERROR: The idmap range for the domain * (tdb) overlaps with the range of SAMDOM (ad)!

ERROR: Do not use the 'ad' backend as the default idmap backend!

Additionally, when using an incorrect ID mapping configuration, the winbindd service now fails to start and an error message is logged. For example:

the IDENTITY MAPPING CONSIDERATIONS section in the smb.conf(5) man page

The ad ID Mapping Back End Now Supports Enabling RFC2307 or Template Mode Per-domain

4.6.0 or later

Previously, when the winbind nss info parameter was set to rfc2307, the Samba ad ID mapping back end retrieved shell and home directory settings for all Active Directory (AD) domains from AD. In Samba 4.6.0, the new idmap config domain_name:unix_nss_info parameter has been added. This parameter enables the administrator to set on a per-AD domain basis if the shell and home directory settings of users should be retrieved from AD or if the template settings, set in the template shell and template homedir parameters are applied.

The new idmap config domain_name:unix_nss_info parameter has a higher priority than the global winbind nss info = rfc2307 setting. Therefore, using the idmap config domain_name:unix_nss_info = no default setting for an AD domain, the shell and home directory are no longer retrieved from AD and the values set in the template shell and template homedir parameters are applied. To re-enable retrieving the values from AD for a domain, set in the [global]section in your smb.conf file: